1. Discuss some types of personal information that companies collect from their customers and discuss what they are used for. How is information collected, and do the customers know about it? Do they have a choice in the matter? Explain how.
2. One of the basic purposes of internal controls is safeguarding of assets. For example, most organizations keep cash in the bank rather than in the office itself. Can you give some of the basic purposes and explain with examples? Is employee data part of company assets?
3. Discuss the privacy concerns that might arise from the use of biometric authentication techniques. What about the embedding of RFID tags in products such as clothing?
4. Would there be any privacy concerns if an unauthorized person gets hold of biometric information stored on a server?
5. How can companies use internal controls to safeguard customer information. Have you heard about social engineering computer crime techniques?
6. hackers and other computer crime perpetrators prefer to use "social engineering" techniques to get around system controls.Do you agree?
7. Data protection is very important. Yet many organizations are unable to protect their data. What data protection techniques have worked for your company, or you think will work?
8. Has anyone heard about cloud computing? Do third-party back-up facilities pose major risks?
9. Would there be any privacy concerns if an unauthorized person gets hold of biometric information stored on a server?
10. Should the government mandate minimum standards for controlling and securing information? Discuss some advantages and disadvantages of the mandate.
11. How would you relate your response to Sarbanes Oxley internal control requirements? Hint: publicly traded companies must establish effective controls over financial reporting.
12. Which of the controls should organizations spend more resources on? - Preventive, detective, or corrective.
13. SOX has changed the work of independent auditors; auditors have to evaluate internal controls and issue an opinion. Further, SOX requires public companies to design and implement internal controls.
Class: Can you explain the role of SOX in protecting customer information?
14. Do you think it is important for auditors and accountants to acquire information technology skills?
15. The "separation of duties" element of an organization's internal control system means that, for instance, employees who are given responsibility for the physical custody of specific company assets (e.g., handling cash or inventory) should not also be given responsibility for the record keeping functions relating to the assets (e.g., recording cash or inventory transactions in the company's journals and ledgers). Otherwise, an employee could misappropriate company assets and then attempt to conceal this fraud by falsifying the accounting records.
Class: How does "separation of duties" help in preventing, detecting and correcting computer security breaches?
16. How will you relate your response to user activity trails?
17. Name a company that you think uses process costing. Name the company's product and state why process costing is appropriate.
18. Process costing is difficult to understand and remember since there are so many little detailed steps in the calculation.
Pick one of the steps in process costing him briefly describe what the step tries to accomplish
19. Do a quick Google search and see if you can find any companies in these that of implementing activity-based costing or who have abandoned an ABC operation. From the details of the article, can you see any trends or issues?
20. What type of organization or company would use activity-based costing?
21. What are the limitations of activity-based costing?